Information is at the center of everything an organization does, and records (a subset of information) are evidence of what the organization does. How an organization manages its information, including its records, can directly affect its ability to successfully compete in the marketplace, comply with regulations, survive an investigation or audit, and recover from disaster. The implementation of new technologies adds yet another layer of factors for considertaion. Every agency should be mapping and tracking its information and preplanning for new technology initiatives with an eye toward better records management and information governance.

As discussed in the February 2014 issue of EMS Insider, the ultimate goal of healthcare reform in the long term is to create a seamless, universal, interoperable electronic health record system for all Americans. But managing, tracking and maintaining electronic health records is only the tip of the information “iceberg” for EMS agencies; there are many other types of information and records that need to be managed, tracked and maintained.

Records & information management

A records and information management (RIM) program is necessary for organizations to proactively (instead of reactively) manage all of their information, regardless of format or location. Think of it as the “tactical approach” with regards to information. By having and adhering to an RIM program, organizations are demonstrating that they are taking “reasonable” steps to manage their information (a defensible position). The program also shows that your organization is following best practices to be able to comply with regulations, survive an investigation or audit, and better recover from a disaster. A records management program is the systematic control of recorded information, from creation, to use and maintenance, through to the final disposition (usually destruction).

With the proliferation of information, organizations need to take a look at how they are managing all of their data. Otherwise, they will find themselves overwhelmed with the amount of data they maintain and the staggering costs that result from this information explosion. Some organizations are further ahead than others with managing a high volume of information. How have they accomplished this? They have implemented records management programs, and some have even begun to add information governance to their repertoire.

RIM programs are tactical—the “how” of information management. Records management is the discipline of managing an organization’s assets—its records—and is something every organization can (and should) implement, even at its barest minimum (i.e., something is better than nothing).

At the very least, a records management program should include a records management policy, procedures describing how to comply with the policy, and a records retention schedule.

Records management policy

As an example, a records management policy should contain:

• A statement that refects the organization’s commitment to good records and information management;

• The scope of who and what aspects of the organization’s business the policy covers; roles and responsibilities (for example, the chief is ultimately responsible for the management of records and information, has authorized the policy and promotes compliance with the policy, and employees—whether paid or volunteer—are responsible for the creation and/or management of records and information and must comply with the policy);

• A statement affrming that the policy will be communicated to all employees and that training will be provided on the aspects of the policy; and,

• An endorsement from senior management (a statement affirming that the chief or other senior manager with responsibility for records information and management has endorsed the policy).

The policy may also include definitions of records and non-records to help employees understand what the company considers to be records and what are non-records. It is not uncommon for organizations to require employees to review the policy on an annual basis and attest to the fact that they understand and will comply with the policy.

Compliance procedures

Procedures should be well documented and accessible to employees so that they can comply with the policy. Procedures provide a standardized method for employees to manage their records, from creation to final disposition. The procedures document can be something as simple as a workfow chart to something more descriptive. The document can be broken down into stages: active, inactive, and final disposition.

Active stage: The active stage is when an employee has identified some information that meets the definition of a record and needs to follow the RIM policy. The procedures document should describe how the employee can manage that record. For example, if it is an email, the procedure will discuss where to retain the email; if it is a paper (or other physical) record, the procedures document discusses how and where to manage that information.

Inactive Stage: The inactive stage occurs when a record must still be retained for business, financial, legal or regulatory reasons, but does not need to be immediately accessible to employees. In this stage, it may be the responsibility of a particular person within the organization to manage it (for example, in the case of closed employee files, a human resources person would manage the files). If the records are paper (or some other physical format) they may be sent to an off-site facility. If the record is electronic, your IT person or department may move it offline to a less expensive storage medium, yet still be able to retrieve it if needed.

Final Disposition Stage: The final disposition stage discusses how a record will be officially “disposed,” which, as previously stated, usually means destruction. However, there are instances where a record may have been deemed a piece of information that the company needs to retain permanently (for example, certain OSHA records, Articles of Incorporation, bylaws and certain financial records).

Records retention schedule

Another component of a records management program is the records retention schedule (RRS). This document describes the different types of records that the organization has and defines how long each type of record needs to be retained. It is developed based on legal records retention requirements under federal, state and sometimes local laws and regulations, and should involve the assistance and approval of legal counsel.

Development and compliance with the RRS is a critical piece of the RIM life-cycle, and one that is often overlooked or avoided—usually due to fear of not having some piece of information available if it is needed or requested. However, the “save everything” mentality is actually more of a risk to an organization than properly destroying records according to an established policy and schedule. The reality is there is no such thing as truly “saving everything.” Voicemail messages and seemingly unimportant emails get deleted, scraps of paper with phone messages or notes that have been transcribed into a more formal document get thrown out, etc. And, every so often, someone within an organization gets the idea that they are going to “clean out” the file cabinets to make more room.

Without an RRS for guidance, the risk to the organization is that a) records may be destroyed prematurely, or b) some records may be properly destroyed, but others that should have also been are not, thereby exposing the organization to possible sanctions in the event of an audit, investigation or lawsuit when there is a “gap” in the records it is able to produce. For example, the computer backup system overwrites every 30 days, but there are boxes of dusty old computer backup tapes from 20 years ago sitting in a storage closet. The fact that the more current data is routinely overwritten (i.e., destroyed)—even if done in accordance with a written policy—while older information still exists, may open the organization up to liability.

The RRS should be easily available to all employees so they can take reasonable steps to comply with the RIM program.

Information governance

Information governance (IG) involves not just records management; it also ensures integrity and reliability of an organization’s information. While an RIM program is a foundational element that can help organizations gain control over the massive explosion of information, IG, on the other hand, uses records management as a foundation and takes information management to the next level by addressing how an organization’s information assets are managed to support company goals. It is therefore strategic rather than tactical. IG includes establishing ownership and accountability for the RIM program, defining metrics to be used to ensure compliance, and managing the lifecycle of information (providing a defensible disposition). IG also includes fostering collaboration among key stakeholders, including legal, compliance, IT, records management and business units.

A properly implemented IG program in conjunction with a RIM program improves accessibility and search capabilities while ensuring appropriate controls (for example, providing proper access to the right people at the right time). It can ensure that compliance obligations are met, reduce risks to the organization and result in improved information use and better company outcomes.

Remember that some of the major focuses of healthcare reform are accountability, transparency and accuracy of information and data. There is no better time than now for organizations to review their current information-related activities and get started with a records management program. The volume of information is going to continue to increase and organizations need to be able to control that growth. An RIM program is the best place to begin. And implementing an IG program helps to ensure that the organization’s information is properly accessible when needed.

This article only scratches the surface. Be sure to consult with an attorney and an RIM/IG professional to review your organization’s specific needs and obtain appropriate advice on these and related issues.

The post Information Explosion appeared first on EMS Insider.

Much has been written about the healthcare reforms contained in the Affordable Care Act, and the ways in which EMS and mobile integrated healthcare can incorporate those changes into their delivery systems. But one thing which has not been discussed much in the EMS and mobile integrated healthcare field is the role and requirements of information technology in the global vision of healthcare reform.

The ultimate goal of healthcare reform is to create a seamless, universal, interoperable electronic record system. This means that if a patient from one place has a medical emergency in another location, the healthcare providers at that location will be able to access the patient’s full medical record—in real time—and thus, treat them more appropriately and effectively. Not surprisingly, there are many obstacles to achieving this goal, including privacy and security, interoperability, differing data dictionaries, intellectual property concerns, consumer acceptance and cost.

By now, most EMS providers are moving in the direction of electronic patient care records (ePCRs), but few are aware of the real reasons behind this move and the greater implications for healthcare reform compliance. Most agencies see ePCRs as a way to collect and compile data, and there has been much discussion about using data to prove your agency’s worth to payers and other third parties. So what are the benefits of this new technology, and what considerations do you need to take into account when adding, changing, upgrading or replacing health information technology?

Meaningful use

In 2009, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act, which authorized incentive payments to clinicians and hospitals through Medicare and Medicaid for using electronic health records (EHRs) to achieve specified improvements in patient care. The incentive payments total up to $27 billion over 10 years, with the ultimate goal of creating a nationwide system of EHRs.

However, HITECH’s goal is not just the adoption of EHRs, but “meaningful use” to achieve significant improvements in caregivers’ decisions and patient outcomes. The regulation spells out what healthcare providers must do with EHRs to be considered meaningful users, including the entry of basic data such as vital signs and demographics, active medications and allergies, up-to-date diagnoses, smoking status and adult weight screening. There are also requirements for the use of clinical decision-making software applications designed to help caregivers make better clinical decisions and avoid preventable errors. Finally, the meaningful use requirements also include providing patients with electronic versions of their health information following treatment and office visits. In short, meaningful use is designed to be a universal minimum set of required data points to measure value and quality, and the rule is part of a larger set of regulations designed to move the health system in a positive direction toward improved quality and effectiveness in healthcare.¹

Unfortunately, since some of the meaningful use data points are not things EMS providers have traditionally asked of or provided for patients, some of the care requirements are not even on the collective EMS radar (let alone built into ePCR systems). But as our nation’s healthcare system moves from a fee-for-service to a fee-for-value model, meaningful use standards and rules will have significant implications for EMS and mobile integrated healthcare providers, especially in light of healthcare reform initiatives such as community paramedicine.

As EMS evolves and expands its role in the healthcare system, meeting meaningful use standards may very well become a requirement. For example, accountable care organizations (ACOs), health systems and other payers will probably require compliance with meaningful use standards as part of payment contracting terms. Community paramedics will likely be required to ask additional questions of patients related to smoking cessation and weight gain/loss during each visit with the patient. For example, community para-medicine programs that are able to bill their state’s Medicaid program will have to record the answers to these types of questions in patient care records, since they will be eligible for receiving reimbursement based upon the quality of care and value they provide, which is measured by the meaningful use standards. It is also foreseeable—as ridiculous as it might seem—that an ACO or payer may require an EMS service to ask the same questions of trauma patients with severe injuries, simply because that is the standard the payer requires from their contracted entities.

Furthermore, if your EMS system is hospital-based, you will almost certainly have to ask meaningful use questions, especially in the case of refusals/treat-and-release situations, and be prepared to provide information, such as discharge and follow-up instructions, to patients out in the field. Remember that under the Emergency Medical Treatment and Active Labor Act (EMTALA), the patient “has come to the emergency department” when they set foot inside your ambulance because the hospital-based EMS unit is deemed an extension of the emergency department. If a patient is refusing transport—or is being treated and released on scene—as an extension of that emergency department, EMS personnel must comply with the same meaningful use standards that the hospital would if the patient were actually transported.

Interoperability

As discussed above, one of the ultimate goals of healthcare reform is to create a nationwide system of EHRs based on the idea that global access to a patient’s medical records will result in better quality, better outcomes, better value and lower costs. To achieve this vision, there must be interoperability.

Interoperability is the concept of diverse software systems, platforms and computer languages all being able to share data. Eventually, all of a patient’s healthcare providers will be able to access the patient’s medical records, regardless of where, when or with what software those records were created.

Aside from the complex technological issues of developing interoperable health information technology, there are other practical obstacles to overcome. For example, a number of EMS agencies have already encountered resistance from hospitals and health systems in their area when they have asked for permission to upload their ePCRs into the hospital’s EHR system or have their quality assurance (QA) manager be granted access to patient charts for follow-up, research and feedback. The hospitals have expressed concern about security and privacy issues, which is understandable; an outside third party over which the hospital has little to no control accessing protected health information (PHI) contained in the system is a scary proposition. As a result, many hospitals do not allow outside healthcare providers to access or upload directly to their software systems.

In addition, the EHR systems used by most hospital systems were not designed with EMS in mind. Likewise, the ePCR systems in use by many EMS agencies were not designed with hospitals and physician practices in mind. As discussed in the December 2012

EMS Insider article, “The Changing Face of Medical Reimbursement: A Difficult Road Ahead for EMS?” EMS agencies and ePCR vendors need to take the lead on this issue; otherwise hospitals may end up dictating which software healthcare providers in their network can use and the results could be extremely costly for EMS agencies. The good news is that a number of the larger ePCR vendors are already developing interoperability tools, but EMS agencies need to get to the table and control the conversation with the hospitals and health systems in their area so they are not forced to switch to an EHR system that was not designed for the EMS environment.

Privacy & security

As discussed above, one of the problems with interoperability is concerns regarding privacy and security of PHI contained in EHR and ePCR systems. Much has been written and will continue to be written about the privacy, security and breach notification requirements contained in HIPAA, so we won’t belabor the point here. However, EMS and mobile integrated healthcare agencies are well advised to think long and hard about the process and procedures for implementing new technologies and maintaining legacy data and information within their own systems; securing and auditing electronic devices such as laptops, tablets and medical equipment that contain patient information to prevent theft, loss or hacking; and developing strong device policies regarding the prohibition or use of personal electronic devices for job-related functions.

Other considerations

If all of this sounds like just another headache to add to the already overwhelming list of healthcare reform changes, here are some recommendations to make things run more smoothly for your agency:

• Think big, start small, move fast.² It’s easy to fall into the trap of focusing on one particular piece of technology without thinking about how it will serve the agency in the long term. Whether it’s a new cardiac monitor, a new pulse oximeter or glucometer, or new ePCR software, it’s important to think strategically and approach each new implementation with an eye toward the “big picture.” In other words, how will this technology grow with us over time? What are its larger capabilities beyond what we plan to use it for right now? Will it be something that needs to or is able to interface with other electronic systems or software and, if so, what are the limitations, obstacles and benefits?

• Don’t be overwhelmed by the idea that you have to have every system or piece of software in place today. Implementation takes time, and begins one piece at a time.

• Don’t jump into new technology without doing proper research and due diligence. On the other hand, don’t get bogged down spending so much time analyzing and researching one item that you fail to move forward.

• Set realistic goals and timelines, do your homework, then move forward. Remember, technology is already outdated as soon as it hits the market, so taking too long to make decisions may mean that you have to start over again if you take too long.

• Have solid policies and compliance and audit systems in place before you add, change, or upgrade anything.

• Protect legacy data and be mindful of vendors who may go out of business or stop supporting current technology. The cost of migrating data from old to new systems is high and the process is time-consuming. Patients (or their lawyers) may request records in “native format” or at an inconvenient time for your organization (for example, while you are in the midst of lengthy data migration), yet you still have an obligation to provide the information upon request and in the form requested (provided the request is reasonable). Before doing anything that requires a data migration, talk with your vendor and come up with a plan that will allow you to meet all obligations seamlessly.

• Read up on HITECH and be prepared for meaningful use to come up in your discussions with ACOs and health systems. At a minimum, they will probably ask about your system capabilities for compliance and information gathering, and it is highly possible they will require compliance with their technology and meaningful use standards as part of a contract for services and/or reimbursement.

• If you are designing a home-grown database for your community para-medicine initiatives, incorporate as many of the meaningful use data points as possible at the outset. For software vendors, as you design and build interoperable ePCR/EHR software, plan to incorporate the meaningful use data points.

• As you implement new technologies designed to interface with and even upload data into your charts, be sure to create a data map of where information is coming from, where it is going to, where it is stored, who or what other device(s) has access to it and the security protocols or features in place. Also, have policies in place that identify those same items and state how long the data created will be retained for, and how you plan to handle upgrades or changes in devices so that legacy data is either preserved in its original form, or migrated to the new system or software.

“It’s easy to get pulled into complex healthcare information projects that can eat up your time and money,” says Todd Stout, president of FirstWatch, a healthcare information technology company. “So it’s important to try to participate in ways and phases that your organization can handle. Also, some of these projects are ‘pilot’ projects, and implementation processes and standards that are not yet proven. Even great approaches can fail due to no fault of the EMS agency, but they can be left with systems, software or hardware that isn’t supported anymore due to a project failure.”

This article scratches only the surface. Be sure to consult with an attorney and a health information technology consultant to review your organization’s specific needs and obtain appropriate advice on these and related issues.

References

1. Blumenthal D, Tavenner M. The “meaningful use” regulation for electronic health records. N Engl J Med. 2010;363(6):501–504.

2. Credit for this phrase goes to Dave Page from FISDAP.

The post Healthcare Information Technology & Healthcare Reform appeared first on EMS Insider.